Which of the following statements describe calculated fields? (select all that apply)
Correct Answer: A,B,D
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/definecalcfields Calculated fields are fields that are created by performing calculations on existing fields using the eval command. Calculated fields can be used in the search bar to filter and transform events based on the calculated values. Calculated fields can also be based on an extracted field, which is a field that is extracted from raw data using various methods, such as regex, delimiters, lookups, etc. Calculated fields are not shortcuts for performing calculations using the eval command, but rather results of performing calculations using the eval command. Calculated fields can be applied to any field in Splunk, not only host and sourcetype. Therefore, statements A, B, and D are true about calculated fields.
SPLK-1002 Exam Question 112
Which of the following expressions could be used to create a calculated field called gigabytes?
Correct Answer: C
SPLK-1002 Exam Question 113
A calculated field maybe based on which of the following?
Correct Answer: B
As mentioned before, a calculated field is a field that you create based on the value of another field or fields2. A calculated field can be based on extracted fields, which are fields that are extracted from your raw data using various methods such as regular expressions, delimiters or key-value pairs2. Therefore, option B is correct, while options A, C and D are incorrect because they are not types of fields that a calculated field can be based on.
SPLK-1002 Exam Question 114
When a search returns __________, you can view the results as a list.
Correct Answer: A
SPLK-1002 Exam Question 115
A data model consists of which three types of datasets?
Correct Answer: B
The building block of a data model. Each data model is composed of one or more data model datasets. Each dataset within a data model defines a subset of the dataset represented by the data model as a whole. Data model datasets have a hierarchical relationship with each other, meaning they have parent-child relationships. Data models can contain multiple dataset hierarchies. There are three types of dataset hierarchies: event, search, and transaction. https://docs.splunk.com/Splexicon:Datamodeldataset